OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_BROWSER_DOWNLOAD_DOWNLOAD_EXTENSIONS_H_ | 5 #ifndef CHROME_BROWSER_DOWNLOAD_DOWNLOAD_EXTENSIONS_H_ |
6 #define CHROME_BROWSER_DOWNLOAD_DOWNLOAD_EXTENSIONS_H_ | 6 #define CHROME_BROWSER_DOWNLOAD_DOWNLOAD_EXTENSIONS_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "base/files/file_path.h" | 10 #include "base/files/file_path.h" |
11 | 11 |
12 namespace download_util { | 12 namespace download_util { |
13 | 13 |
14 enum DownloadDangerLevel { | 14 enum DownloadDangerLevel { |
| 15 // Safe. Or at least not known to be dangerous. Safe to download and open, |
| 16 // even if the download was accidental. |
15 NOT_DANGEROUS, | 17 NOT_DANGEROUS, |
| 18 |
| 19 // Require confirmation before downloading. An additional user gesture may not |
| 20 // be required if the download was from a familiar site and the download was |
| 21 // initiated via a user action. |
16 ALLOW_ON_USER_GESTURE, | 22 ALLOW_ON_USER_GESTURE, |
| 23 |
| 24 // Always require confirmation when downloading. |
17 DANGEROUS | 25 DANGEROUS |
18 }; | 26 }; |
19 | 27 |
20 // Determine the download danger level of a file. | 28 // Determine the download danger level of a file. |
21 DownloadDangerLevel GetFileDangerLevel(const base::FilePath& path); | 29 DownloadDangerLevel GetFileDangerLevel(const base::FilePath& path); |
22 | 30 |
| 31 // Returns true if the file specified by |path| is allowed to open |
| 32 // automatically. |
| 33 // |
| 34 // Not all downloads are initiated with the consent of the user. Even when the |
| 35 // user consents, the file written to disk may differ from the users' |
| 36 // expectations. I.e. a malicious website could drop a nefarious download |
| 37 // possibly by click jacking, or by serving a file that is different from what |
| 38 // the user intended to download. |
| 39 // |
| 40 // Any prompting done in order to validate a dangerous download is a speed bump |
| 41 // rather than a security measure. The user likely doesn't have the information |
| 42 // necessary to evaluate the safety of a downloaded file. In addition, downloads |
| 43 // with a danger type of ALLOW_ON_USER_GESTURE might not prompt at all. So |
| 44 // Chrome forces the user to manually open some file types by preventing them |
| 45 // from being opened automatically. See https://crbug.com/461858 |
| 46 // |
| 47 // See DownloadAutoOpenHint for details on the criteria used to disallow |
| 48 // automatic opening for a file type. |
| 49 bool IsAllowedToOpenAutomatically(const base::FilePath& path); |
| 50 |
23 // Tests if we think the server means for this mime_type to be executable. | 51 // Tests if we think the server means for this mime_type to be executable. |
24 bool IsExecutableMimeType(const std::string& mime_type); | 52 bool IsExecutableMimeType(const std::string& mime_type); |
25 | 53 |
26 } // namespace download_util | 54 } // namespace download_util |
27 | 55 |
28 #endif // CHROME_BROWSER_DOWNLOAD_DOWNLOAD_EXTENSIONS_H_ | 56 #endif // CHROME_BROWSER_DOWNLOAD_DOWNLOAD_EXTENSIONS_H_ |
OLD | NEW |